Sunday, 23 August 2009

Induc is a File infector virus. This doesn't infect the exe's, instead it checks if Delphi(versions 4.0 -7.0) is installed on the machine.If Delphi installation is found it copies SysConst.pas(source program,pas =pascal) to \Lib folder and overwrites its code. It renames the original %DelphiRootDir%\lib\sysconst.dcu (dcu =Delphi compiled unit, Delphi compiled code) into SysConst.bak. It now compiles the modified sysconst.pas to produce a infected copy of sysconst.dcu file and deletes the modified version of sysconst.pas file. There by infecting all the new compiled Delphi programs on this computer. [1],[2]